Most recent entries from all

ALSA-2020:4807 — Moderate: prometheus-jmx-exporter security update

Affected: AlmaLinux:8: prometheus-jmx-exporter

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.

Security Fix(es):

* snakeyaml: Billion laughs attack via alias feature (CVE-2017-18640)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-02625

certfr-2022-avi-266 — De multiples vulnérabilités ont été découvertes dans IBM WebSphere Service Registry and Repository. Certaines d'entre e…

certfr-2022-avi-266

cnvd-2020-22682

EUVD-2026-80393

fkie_cve-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

GHSA-rvwf-54qp-4r6v — SnakeYAML Entity Expansion during load operation

Affected: Maven: org.yaml:snakeyaml

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

gsd-2017-18640

jvndb-2022-000062

Kaitai Struct: compiler provided by Kaitai team contains SnakeYAML library version 1.25, which is used in parsing .ksy files. SnakeYAML version 1.25 expands recursive aliases unlimitedly (CWE-674), hence Katai Struct: compiler is vulnerable to a denial-of-service (DoS) attack by Billion Laughs Attack. Taichi Kotake of Sterra Security Co.,Ltd. / Akatsuki Games Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

msrc_CVE-2017-18640 — The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003…

msrc_CVE-2017-18640

openSUSE-SU-2021:0855-1 — Security update for snakeyaml

Security update for snakeyaml

RHSA-2020:2603 — Red Hat Security Advisory: Red Hat build of Quarkus 1.3.4 security update

snakeyaml: Billion laughs attack via alias feature

SUSE-SU-2021:1876-1 — Security update for snakeyaml

Security update for snakeyaml

UBUNTU-CVE-2017-18640

Affected: Ubuntu:Pro:14.04:LTS: snakeyaml, Ubuntu:Pro:16.04:LTS: snakeyaml, Ubuntu:Pro:18.04:LTS: snakeyaml, Ubuntu:Pro:20.04:LTS: snakeyaml

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

WID-SEC-W-2022-0770 — IBM DB2: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen